feat(ec-updates): don't allow updates of >1 minor kube versions for airgap (#5473)

Author: sgalsaleh

go.mod

@@ -51,7 +51,7 @@ require (
 	github.com/pkg/errors v0.9.1
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2
 	github.com/replicatedhq/embedded-cluster/kinds v1.15.1-0.20250729184643-f055e67a064d
-	github.com/replicatedhq/kotskinds v0.0.0-20250411153224-089dbeb7ba2a
+	github.com/replicatedhq/kotskinds v0.0.0-20250813145521-a47bae9097bc
 	github.com/replicatedhq/kurlkinds v1.5.0
 	github.com/replicatedhq/troubleshoot v0.121.2
 	github.com/replicatedhq/yaml/v3 v3.0.0-beta5-replicatedhq

go.sum

@@ -1862,8 +1862,8 @@ github.com/remyoudompheng/bigfft v0.0.0-20170806203942-52369c62f446/go.mod h1:uY
 github.com/remyoudompheng/bigfft v0.0.0-20200410134404-eec4a21b6bb0/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
 github.com/replicatedhq/embedded-cluster/kinds v1.15.1-0.20250729184643-f055e67a064d h1:Wl0fHoWTcrveqbWmDVEPFoa/K3EzyROC8tjHZxzwg3Q=
 github.com/replicatedhq/embedded-cluster/kinds v1.15.1-0.20250729184643-f055e67a064d/go.mod h1:gZdtXCAVJt0a5Ry64Jlaeph7qh+IGsAkq4P0PE6XiZI=
-github.com/replicatedhq/kotskinds v0.0.0-20250411153224-089dbeb7ba2a h1:aNZ7qcuEmPGIUIIfxF7c0sdKR2+zL2vc5r2V8j8a49I=
-github.com/replicatedhq/kotskinds v0.0.0-20250411153224-089dbeb7ba2a/go.mod h1:QjhIUu3+OmHZ09u09j3FCoTt8F3BYtQglS+OLmftu9I=
+github.com/replicatedhq/kotskinds v0.0.0-20250813145521-a47bae9097bc h1:ytcOyselshUTCaUcWakxn0ltt1HFM+6LWez02Uik+J8=
+github.com/replicatedhq/kotskinds v0.0.0-20250813145521-a47bae9097bc/go.mod h1:oR0Gnu3MwBFVM75uwmLFmhTtEsKQlvECHQ27oHUb9TM=
 github.com/replicatedhq/kurlkinds v1.5.0 h1:zZ0PKNeh4kXvSzVGkn62DKTo314GxhXg1TSB3azURMc=
 github.com/replicatedhq/kurlkinds v1.5.0/go.mod h1:rUpBMdC81IhmJNCWMU/uRsMETv9P0xFoMvdSP/TAr5A=
 github.com/replicatedhq/termui/v3 v3.1.1-0.20200811145416-f40076d26851 h1:eRlNDHxGfVkPCRXbA4BfQJvt5DHjFiTtWy3R/t4djyY=

pkg/airgap/update.go

@@ -95,7 +95,8 @@ func UpdateAppFromPath(a *apptypes.App, airgapRoot string, airgapBundlePath stri
 		return errors.Wrap(err, "failed to find airgap meta")
 	}
 
-	deployable, nonDeployableCause, err := update.IsAirgapUpdateDeployable(a, airgap)
+	currentECVersion := util.EmbeddedClusterVersion()
+	deployable, nonDeployableCause, err := update.IsAirgapUpdateDeployable(a, airgap, currentECVersion)
 	if err != nil {
 		return errors.Wrapf(err, "failed to check if airgap update is deployable")
 	}

pkg/handlers/app.go

@@ -569,7 +569,8 @@ func (h *Handler) CanInstallAppVersion(w http.ResponseWriter, r *http.Request) {
 			return
 		}
 
-		deployable, nonDeployableCause, err := update.IsAirgapUpdateDeployable(a, decoded.(*kotsv1beta1.Airgap))
+		currentECVersion := util.EmbeddedClusterVersion()
+		deployable, nonDeployableCause, err := update.IsAirgapUpdateDeployable(a, decoded.(*kotsv1beta1.Airgap), currentECVersion)
 		if err != nil {
 			response.Error = "failed to check if airgap update is deployable"
 			logger.Error(errors.Wrap(err, response.Error))

pkg/handlers/upgrade_service.go

@@ -124,7 +124,8 @@ func canStartUpgradeService(a *apptypes.App, r StartUpgradeServiceRequest) (bool
 		if r.ChannelID != airgap.Spec.ChannelID {
 			return false, "channel mismatch", nil
 		}
-		isDeployable, nonDeployableCause, err := update.IsAirgapUpdateDeployable(a, airgap)
+		currentECVersion := util.EmbeddedClusterVersion()
+		isDeployable, nonDeployableCause, err := update.IsAirgapUpdateDeployable(a, airgap, currentECVersion)
 		if err != nil {
 			return false, "", errors.Wrap(err, "failed to check if airgap update is deployable")
 		}

pkg/update/required.go

@@ -57,7 +57,7 @@ func getAvailableUpdates(updates []upstreamtypes.Update, currentECVersion string
 	return availableUpdates
 }
 
-func IsAirgapUpdateDeployable(app *apptypes.App, airgap *kotsv1beta1.Airgap) (bool, string, error) {
+func IsAirgapUpdateDeployable(app *apptypes.App, airgap *kotsv1beta1.Airgap, currentECVersion string) (bool, string, error) {
 	appVersions, err := store.GetStore().FindDownstreamVersions(app.ID, true)
 	if err != nil {
 		return false, "", errors.Wrap(err, "failed to get downstream versions")
@@ -73,6 +73,12 @@ func IsAirgapUpdateDeployable(app *apptypes.App, airgap *kotsv1beta1.Airgap) (bo
 	if len(requiredUpdates) > 0 {
 		return false, getRequiredNonDeployableCause(requiredUpdates), nil
 	}
+	// If this is an EC install, check if the update kubernetes version is within the range of what we can upgrade to
+	if currentECVersion != "" && airgap.Spec.EmbeddedClusterVersion != "" {
+		if err := util.UpdateWithinKubeRange(currentECVersion, airgap.Spec.EmbeddedClusterVersion); err != nil {
+			return false, getKubeVersionNonDeployableCause(err), nil
+		}
+	}
 	return true, "", nil
 }
 

pkg/update/required_test.go

@@ -4,8 +4,12 @@ import (
 	"testing"
 
 	"github.com/blang/semver"
+	"github.com/golang/mock/gomock"
 	downstreamtypes "github.com/replicatedhq/kots/pkg/api/downstream/types"
+	apptypes "github.com/replicatedhq/kots/pkg/app/types"
 	"github.com/replicatedhq/kots/pkg/cursor"
+	"github.com/replicatedhq/kots/pkg/store"
+	mock_store "github.com/replicatedhq/kots/pkg/store/mock"
 	kotsv1beta1 "github.com/replicatedhq/kotskinds/apis/kots/v1beta1"
 	"github.com/stretchr/testify/require"
 )
@@ -287,3 +291,161 @@ func Test_getRequiredAirgapUpdates(t *testing.T) {
 		})
 	}
 }
+
+func TestIsAirgapUpdateDeployable(t *testing.T) {
+	tests := []struct {
+		name             string
+		airgap           *kotsv1beta1.Airgap
+		currentECVersion string
+		wantDeployable   bool
+		wantCause        string
+		setupStore       func(mockStore *mock_store.MockStore)
+	}{
+		{
+			name: "not deployable due to required releases",
+			airgap: &kotsv1beta1.Airgap{
+				Spec: kotsv1beta1.AirgapSpec{
+					ChannelID: "test-channel",
+					RequiredReleases: []kotsv1beta1.AirgapReleaseMeta{
+						{
+							VersionLabel: "1.0.0",
+							UpdateCursor: "100",
+						},
+					},
+					AirgapReleaseMeta: kotsv1beta1.AirgapReleaseMeta{
+						VersionLabel:           "1.1.0",
+						UpdateCursor:           "110",
+						EmbeddedClusterVersion: "2.7.4+k8s-1.30",
+					},
+				},
+			},
+			currentECVersion: "2.7.3+k8s-1.29",
+			wantDeployable:   false,
+			wantCause:        "This version cannot be deployed because version 1.0.0 is required and must be deployed first.",
+			setupStore: func(mockStore *mock_store.MockStore) {
+				s := semver.MustParse("0.9.0")
+				c := cursor.MustParse("90")
+				mockStore.EXPECT().FindDownstreamVersions("test-app", true).Return(&downstreamtypes.DownstreamVersions{
+					AllVersions: []*downstreamtypes.DownstreamVersion{
+						{
+							ChannelID:    "test-channel",
+							VersionLabel: "0.9.0",
+							UpdateCursor: "90",
+							Semver:       &s,
+							Cursor:       &c,
+						},
+					},
+				}, nil)
+			},
+		},
+		{
+			name: "deployable when no required updates and compatible EC version",
+			airgap: &kotsv1beta1.Airgap{
+				Spec: kotsv1beta1.AirgapSpec{
+					ChannelID: "test-channel",
+					AirgapReleaseMeta: kotsv1beta1.AirgapReleaseMeta{
+						EmbeddedClusterVersion: "2.7.4+k8s-1.30",
+					},
+				},
+			},
+			currentECVersion: "2.7.3+k8s-1.29",
+			wantDeployable:   true,
+			wantCause:        "",
+			setupStore: func(mockStore *mock_store.MockStore) {
+				mockStore.EXPECT().FindDownstreamVersions("test-app", true).Return(&downstreamtypes.DownstreamVersions{
+					AllVersions: []*downstreamtypes.DownstreamVersion{},
+				}, nil)
+			},
+		},
+		{
+			name: "not deployable due to EC version incompatibility",
+			airgap: &kotsv1beta1.Airgap{
+				Spec: kotsv1beta1.AirgapSpec{
+					ChannelID: "test-channel",
+					AirgapReleaseMeta: kotsv1beta1.AirgapReleaseMeta{
+						EmbeddedClusterVersion: "2.8.0+k8s-1.31",
+					},
+				},
+			},
+			currentECVersion: "2.7.4+k8s-1.29",
+			wantDeployable:   false,
+			wantCause:        "Before you can update to this version, you need to update to an earlier version that includes the required infrastructure update.",
+			setupStore: func(mockStore *mock_store.MockStore) {
+				mockStore.EXPECT().FindDownstreamVersions("test-app", true).Return(&downstreamtypes.DownstreamVersions{
+					AllVersions: []*downstreamtypes.DownstreamVersion{},
+				}, nil)
+			},
+		},
+		{
+			name: "deployable when airgap EC version is empty",
+			airgap: &kotsv1beta1.Airgap{
+				Spec: kotsv1beta1.AirgapSpec{
+					ChannelID: "test-channel",
+					AirgapReleaseMeta: kotsv1beta1.AirgapReleaseMeta{
+						EmbeddedClusterVersion: "",
+					},
+				},
+			},
+			currentECVersion: "2.7.3+k8s-1.29",
+			wantDeployable:   true,
+			wantCause:        "",
+			setupStore: func(mockStore *mock_store.MockStore) {
+				mockStore.EXPECT().FindDownstreamVersions("test-app", true).Return(&downstreamtypes.DownstreamVersions{
+					AllVersions: []*downstreamtypes.DownstreamVersion{},
+				}, nil)
+			},
+		},
+		{
+			name: "deployable when current EC version is empty (non-ec installation) even if airgap EC version is set",
+			airgap: &kotsv1beta1.Airgap{
+				Spec: kotsv1beta1.AirgapSpec{
+					ChannelID: "test-channel",
+					AirgapReleaseMeta: kotsv1beta1.AirgapReleaseMeta{
+						EmbeddedClusterVersion: "2.7.5+k8s-1.30",
+					},
+				},
+			},
+			currentECVersion: "",
+			wantDeployable:   true,
+			wantCause:        "",
+			setupStore: func(mockStore *mock_store.MockStore) {
+				mockStore.EXPECT().FindDownstreamVersions("test-app", true).Return(&downstreamtypes.DownstreamVersions{
+					AllVersions: []*downstreamtypes.DownstreamVersion{},
+				}, nil)
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ctrl := gomock.NewController(t)
+			defer ctrl.Finish()
+
+			mockStore := mock_store.NewMockStore(ctrl)
+			tt.setupStore(mockStore)
+
+			store.SetStore(mockStore)
+			defer store.SetStore(nil)
+
+			app := &apptypes.App{
+				ID:                "test-app",
+				SelectedChannelID: "test-channel",
+				License: `apiVersion: kots.io/v1beta1
+kind: License
+spec:
+  channelID: test-channel
+  channels:
+  - channelID: test-channel
+    channelName: Test
+    isDefault: true
+    isSemverRequired: false`,
+			}
+
+			deployable, cause, err := IsAirgapUpdateDeployable(app, tt.airgap, tt.currentECVersion)
+
+			require.NoError(t, err)
+			require.Equal(t, tt.wantDeployable, deployable)
+			require.Equal(t, tt.wantCause, cause)
+		})
+	}
+}

pkg/update/update.go

@@ -93,7 +93,8 @@ func GetAvailableAirgapUpdates(app *apptypes.App, license *kotsv1beta1.License)
 			return nil // skip airgap updates that are not for the current channel, preserving previous behavior
 		}
 
-		deployable, nonDeployableCause, err := IsAirgapUpdateDeployable(app, airgap)
+		currentECVersion := util.EmbeddedClusterVersion()
+		deployable, nonDeployableCause, err := IsAirgapUpdateDeployable(app, airgap, currentECVersion)
 		if err != nil {
 			return errors.Wrap(err, "failed to check if airgap update is deployable")
 		}